CVE-2025-71399

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.4.5

Description Better Auth utilizes the better-call library, which depends on the rou3 router. In affected versions of rou3, paths are normalized by removing empty segments, causing paths such as /path, //path, and ///path to resolve to the same route. This behavior allows attackers to bypass the disabledPaths configuration and path-based rate limits by including extra slashes in the URL path. This issue does not affect deployments where the proxy or platform automatically normalizes URLs by collapsing multiple slashes.

Recommendations Update Better Auth to version 1.4.5 or later. Ensure the proxy normalizes URLs by collapsing multiple slashes before they reach the handler.